What is a sandbox test CVV?
A sandbox test CVV is a placeholder card verification value used with test card numbers inside a payment gateway's developer environment. It passes format checks without belonging to a real cardholder or a real bank account. Gateways publish these codes so developers can build checkout flows, run charge and decline scenarios, and test fraud rules before launch.
The value is fake by design. Nothing is charged, no issuer is contacted, and the number is safe to share in code repositories, staging servers, and onboarding docs.
How does CVV checking work in test mode?
In test mode, a gateway skips the card networks and compares the submitted CVV against rules stored in its own sandbox. No bank ever sees the request.
Most gateways accept any three digits for a generic test card, so 123, 000, and 999 all return a successful authorization. Some providers reserve specific codes to simulate a failed CVV check, a "not verified" result, or a "not applicable" result. That lets you write and verify error handling without touching real card data.
- Format rule: Visa, Mastercard, and Discover test cards take three digits. American Express test cards take four.
- Any-digit rule: generic test cards accept any value in the correct length.
- Trigger rule: a small set of test cards or CVV values always produce a specific decline or verification response.
Where do developers find test CVV values?
Every large gateway maintains a test card table in its own developer docs. The table lists card numbers, expiry dates, CVV rules, and the response each card triggers. Pull values from the official table rather than from forum posts, which often carry outdated numbers.
Stripe test CVVs
Stripe's test card 4242 4242 4242 4242 accepts any three-digit CVC, any future expiry date, and any billing ZIP. Card 4000 0000 0000 0101 always returns a CVC check failure, which makes it useful for testing your decline message. Both cards work in test mode only.
PayPal and Braintree test CVVs
The PayPal developer portal generates sandbox card numbers tied to a specific test merchant account, and each generated card takes a standard three-digit CVV. Braintree test cards follow the same pattern, with a short list of dummy CVV values that map to defined gateway responses. Confirm the mapping in the current docs before you build assertions around it.
Adyen and Authorize.net test CVVs
Adyen test cards usually name one fixed CVC next to each card number, so you must copy that exact value. Authorize.net test mode accepts its published test card numbers with any CVV in the right format. Check each table because the rules differ between card brands inside the same provider.
Do sandbox CVV numbers work in live mode?
No. A live gateway routes the request to the card network, and the network rejects a test card because no issuer stands behind it. The CVV value itself is irrelevant once the card number fails.
Keep test keys and live keys in separate configuration files, and load them from environment variables. Mixing the two is the most common cause of "card declined" tickets during a launch.
What CVV response codes can a sandbox return?
Sandboxes mirror the response codes that card issuers send in production. You can trigger most of them with a chosen test card or a chosen CVV value.
- Match: the CVV matches issuer records.
- No match: the CVV is wrong. Many gateways decline the charge and let you retry.
- Not processed: the issuer skipped the check.
- Not verified: the issuer does not support CVV verification.
- Not applicable: the card brand has no CVV on file, which happens with some commercial cards.
Build a test case for each row and log which code your checkout shows the buyer. Clear copy at that moment cuts support tickets.
Sandbox test CVV vs a real CVV
A test CVV is published data meant for developers. A real CVV is issued by a bank, printed on a physical card, and treated as private under PCI DSS rules. Gateways and processors forbid storing it after an authorization.
Using a real card number and CVV without the cardholder's permission is card fraud. It carries criminal penalties in the US and most other countries, and processors block and report that traffic when they detect it.
Offers to sell live CVV data point to one of two things: stolen card records or a scam that harvests the buyer's own details. Test data from official developer documentation costs nothing and carries zero legal risk. If your goal is checkout testing, the sandbox is the whole answer.
Best practices for sandbox card testing
- Copy test card numbers and CVV rules from the gateway's current docs, not from blog archives.
- Store test cards in fixtures or seed files so every environment runs the same data.
- Test the happy path and at least three failure paths: bad CVV, expired card, and insufficient funds.
- Never log CVV values in your own application, even in test mode, so production logging rules stay clean.
- Match your test card currency and country to the market you serve, since some gateways reject cross-border test cards.
- Re-run your suite after every gateway API version change, because test card tables do shift.
Frequently asked questions
Is 123 a valid sandbox CVV?
For most gateways, yes. Generic test cards accept any three-digit CVV, and 123 is the value used in most documentation examples.
Why does my sandbox reject CVV 000?
Some gateways treat 000 as a malformed value or map it to a decline trigger. Check the provider's test table and use a normal three-digit value instead.
Can I use my own real card in a sandbox?
You can, and some gateways allow it, but you gain nothing and expose live card data to a test system. Use test cards until you run a controlled production check.
Does a sandbox test CVV expire?
The card number usually has no expiry, but the test table itself changes over time. Set the expiry date in your test data to a future year and refresh it when the gateway updates its docs.
Key takeaways
- A sandbox test CVV is fake data that passes format checks in a developer environment.
- Most test cards accept any three-digit CVV; a few trigger declines on purpose.
- Test CVVs and test card numbers fail in live mode.
- Official developer docs are the only source you need, and they are free.